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Foreword 



id , 



This Technical Specification (TS) has been produced by the 3 Generation Partnership Project (3GPP). 

The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

x the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 



Introduction 



This document has been prepared by the 3GPP Task Force, and contains an example set of algorithms which may be 
used as the authentication and key generation functions fl,fl*, J2, f3,f4,f5 and/5*. (It is not mandatory that the 
particular algorithms specified in this document are used — all seven functions are operator-specifiable rather than 
being fully standardised). This document is one five, which between them form the entire specification of the example 
algorithms, entitled: 

3GPP TS 35.205: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the MILENAGE Algorithm Set: An example algorithm set for the 3GPP 
authentication and key generation functions fl, fl*, f2, f3, f4, f5 and f5*; 
Document 1: General". 

3GPP TS 35.206: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the MILENAGE Algorithm Set: An example algorithm set for the 3GPP 
authentication and key generation functions fl, fl*, f2, f3, f4, f5 and f5*; 
Document 2: Algorithm Specification". 

3GPP TS 35.207: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the MILENAGE Algorithm Set: An example algorithm set for the 3GPP 
authentication and key generation functions fl, fl*, f2, f3, f4, f5 and f5*; 
Document 3: Implementors' Test Data". 

- 3GPP TS 35.208: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the MILENAGE Algorithm Set: An example algorithm set for the 3GPP 
authentication and key generation functions fl, fl*, f2, f3, f4, f5 and f5*; 
Document 4: Design Conformance Test Data". 

3GPP TR 35.909: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the MILENAGE Algorithm Set: An example algorithm set for the 3GPP 
authentication and key generation functions fl, fl*, f2, f3, f4, f5 and f5*; 
Document 5: Summary and results of design and evaluation". 
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The name "MILENAGE" 



The name of this algorithm set is "MILENAGE". It should be pronounced like a French word — something like "mi- 
le-nahj". 



Outline of the document 



Section 2 introduces the algorithms and describes the notation used in the subsequent sections. 

Section 3 explains how the algorithms are designed as a framework in such a way that various "customising 
components" can be selected in order to customise the algorithm for a particular operator. 

Section 4 defines the example algorithms. The algorithm framework is defined in section 4.1; in section 4.2, specific 
instances of the components are selected to define the specific example algorithm set. 

Section 5 explains various options and considerations for implementation of the algorithms, including considerations to 
be borne in mind when modifying the customising components. 

Illustrative pictures are given in Annex 1 . Annex 2 gives a specification of the block cipher algorithm which is used as a 
cryptographic kernel in the definition of the example algorithms. Annexes 3 and 4 contain source code in the C 
programming language: Annex 3 gives a complete and straightforward implementation of the algorithm set, while 
Annex 4 gives an example of an alternative high-performance implementation just of the kernel function. 

1.1 References 

The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. 

• References are either specific (identified by date of publication, edition number, version number, etc.) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including 
a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same 
Release as the present document. 

[1] 3GPP TS 33.102 v3.5.0: "3rd Generation Partnership Project; Technical Specification Group 

Services and System Aspects; 3G Security; Security Architecture". 

[2] 3GPP TS 33.105 v3.4.0: "3rd Generation Partnership Project; Technical Specification Group 

Services and System Aspects; 3G Security; Cryptographic Algorithm Requirements". 

[3] 3GPP TS 35.206: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the MILENAGE Algorithm Set: An example 
algorithm set for the 3GPP authentication and key generation functions fl, fl*, f2, G, f4, f5 and 
f5*; Document 2: Algorithm Specification" (this document). 

[4] 3GPP TS 35.207: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the MILENAGE Algorithm Set: An example 
algorithm set for the 3GPP authentication and key generation functions fl, fl*, f2, G, f4, f5 and 
f5*; Document 3: Implementors' Test Data". 

[5] 3GPP TS 35.208: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the MILENAGE Algorithm Set: An example 
algorithm set for the 3GPP authentication and key generation functions fl, fl*, f2, G, f4, f5 and 
f5*; Document 4: Design Conformance Test Data". 
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[6] Joan Daemen and Vincent Rijmen: "AES Proposal: Rijndael", available at 

http://csrc.nist.gov/encryption/aes/round2/AESAlgs/Riindael/Riindael.pdf or 
http://www.esat.kuleuven.ac.be/~riimen/riindael/riindaeldocV2.zip 

[7] http://csrc.nist.gov/encryption/aes/ 

[8] Thomas S. Messerges, "Securing the AES finalists against Power Analysis Attacks", in FSE 2000, 

Seventh Fast Software Encryption Workshop, ed. Schneier, Springer Verlag, 2000. 

[9] P. C. Kocher, "Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other 

Systems", in CRYPTO'96, Lecture Notes in Computer Science #1 109, Springer Verlag, 1996. 

[10] J. Kelsey, B. Schneier, D. Wagner, C. Hall, "Side Channel Cryptanalysis of Product Ciphers", in 

ESORICS'98, Lecture Notes in Computer Science #1485, Springer Verlag, 1998. 

[11] L. Goubin, J. Patarin, "DES and differential power analysis", in CHES'99, Lecture Notes in 

Computer Science #1717, Springer Verlag, 1999. 

[12] P. Kocher, J. Jaffe, B. Jun, "Differential Power Analysis", in CRYPTO'99, Lecture Notes in 

Computer Science #1666, Springer Verlag, 1999. 

[13] L. Goubin, J.-S. Coron, "On boolean and arithmetic masking against differential power analysis", 

in CHES'OO, Lecture Notes in Computer Science series, Springer Verlag (to appear). 



INTRODUCTORY INFORMATION 



2.1 Introduction 

Within the security architecture of the 3GPP system there are seven security functions/7, /7*,/2,/3,/4,/5 and/5*. 
The operation of these functions falls within the domain of one operator, and the functions are therefore to be specified 
by each operator rather than being fully standardised. The algorithms specified in this document are examples that may 
be used by an operator who does not wish to design his own. 

The inputs and outputs of all seven algorithms are defined in section 2.4. 

2.2 Notation 

2.2.1 Radix 

We use the prefix Ox to indicate hexadecimal numbers. 

2.2.2 Conventions 

We use the assignment operator '=', as used in several programming languages. When we write 

<variable> = <expression> 
we mean that <variable> assumes the value that <expression> had before the assignment took place. For instance, 

x = x + y + 3 
means 

(new value of x) becomes (old value of x) + (old value of y) + 3. 

2.2.3 Bit/Byte ordering 

All data variables in this specification are presented with the most significant bit (or byte) on the left hand side and the 
least significant bit (or byte) on the right hand side. Where a variable is broken down into a number of substrings, the 
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leftmost (most significant) substring is numbered 0, the next most significant is numbered 1, and so on through to the 
least significant. 



2.2.4 List of Symbols 



E[x] k 
rot(x,r) 



X[i] 



The assignment operator. 

The bitwise exclusive-OR operation 

The concatenation of the two operands. 

The result of applying a block cipher encryption to the input value x using the key k. 

The result of cyclically rotating the 128-bit value x by r bit positions towards the most significant 

bit. If x = x[0] II x[l] II . . . x[127], and y = rot(x,r), 

then y = x[r] II x[r+l] II ... x[127] II x[0] II x[l] II x[r-l]. 



The r bit of the variable X. (X = X[0] II X[l] II X[2] 



). 



2.3 List of Variables 

AK a 48-bit anonymity key that is the output of either of the functions /5 and/5*. 

AMF a 16-bit authentication management field that is an input to the functions/7 and/7*. 

cl,c2,c3,c4,c5 128-bit constants, which are XORed onto intermediate variables. 

CK a 128-bit confidentiality key that is the output of the function/3. 

IK a 128-bit integrity key that is the output of the function/4. 

INI a 128 -bit value constructed from SQN and AMF and used in the computation of the functions /7 

and/7*. 
K a 128-bit subscriber key that is an input to the functions /7,/7*,/2,/3,/4,/5 and/5*. 

MAC- A a 64-bit network authentication code that is the output of the function/7. 

MAC-S a 64-bit resynchronisation authentication code that is the output of the function/7*. 

OP a 128-bit Operator Variant Algorithm Configuration Field that is a component of the functions/7, 

/7*,/2,/3,/4,/5 and/5*. 
OP c a 128-bit value derived from OP and K and used within the computation of the functions. 

OUTl,OUT2,OUT3,OUT4,OUT5 

128-bit computed values from which the outputs of the functions /7,/7*,/2,/3,/4,/5 and/5* are 

obtained. 
rl,r2,r3,r4,r5 integers in the range 0-127 inclusive, which define amounts by which intermediate variables are 

cyclically rotated. 
RAND a 128-bit random challenge that is an input to the functions /7,/7*,/2,/3,/4,/5 and/5*. 

RES a 64-bit signed response that is the output of the function/2. 

SQN a 48-bit sequence number that is an input to either of the functions /7 and/7*. (For/7* this input 

is more precisely called SQN M s) 
TEMP a 128-bit value used within the computation of the functions. 

2.4 Algorithm Inputs and Outputs 

The inputs to the algorithms are given in tables 1 and 2, the outputs in tables 3-9 below. 

Table 1 : inputs to f1 and f1* 



Parameter 


Size (bits) 


Comment 


K 


128 


Subscriber key K[0]...K[127] 


RAND 


128 


Random challenge RAND[0]...RAND[127] 


SQN 


48 


Sequence number SQN[0]...SQN[47]. (For ft'this input is 
more precisely called SQNms-) 


AMF 


16 


Authentication management field AMF[0]...AMF[15] 



Table 2: inputs to f2, f3, f4, f5 and f5* 



Parameter 


Size (bits) 


Comment 


K 


128 


Subscriber key K[0]...K[127] 


RAND 


128 


Random challenge RAND[0]...RAND[127] 
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Table 3: 11 output 



Parameter 


Size (bits) 


Comment 


MAC-A 


64 


Network authentication code MAC-A[0]...MAC 


-A[63] 


Table 4: 11* output 


Parameter 


Size (bits) 


Comment 


MAC-S 


64 


Resynch authentication code MAC-S[0]...MAC 


-S[63] 


Tables. 12 output 


Parameter 


Size (bits) 


Comment 


RES 


64 


Response RES[0]...RES[63] 


Table 6. 13 output 


Parameter 


Size (bits) 


Comment 


CK 


128 


Confidentiality key CK[0]...CK[127] 


Table 7. 14 output 


Parameter 


Size (bits) 


Comment 


IK 


128 


Integrity key IK[0]...IK[127] 


Table 8. f5 output 


Parameter 


Size (bits) 


Comment 


AK 


48 


Anonymity key AK[0]...AK[47] 


Table 9. 15* output 


Parameter 


Size (bits) 


Comment 


AK 


48 


Resynch anonymity key AK[0]...AK[47] 



Note: Both f5 and f5* outputs are called AK according to reference [2]. In practice only one of them will be calculated 
in each instance of the authentication and key agreement procedure. 



3 The algorithm framework and the specific example 

algorithms 

The example algorithm set makes use of the following components: 

A block cipher encryption function, which takes a 128-bit input and a 128-bit key and returns a 128-bit output. 
If the input is x, the key is k and the output is y, we write y = E[x] k . 

A 128-bit value OP. This is an Operator Variant Algorithm Configuration Field, which the Task Force was 
asked to include as a simple means to provide separation between the functionality of the algorithms when used 
by different operators. It is left to each operator to select a value for OP. The algorithm set is designed to be 
secure whether or not OP is publicly known; however, operators may see some advantage in keeping their value 
of OP secret. This and other aspects of the use of OP are discussed further in section 5. 

In the specific example algorithm set, a particular block cipher is used. But the algorithms have been designed so that 
this component can be replaced by any operator who wishes to create his own customised algorithm set. In that sense 
this document defines an algorithm framework, and the example algorithm set is one that fits within the framework. 
This is how the algorithm set is defined in section 4: in section 4. 1 the framework is defined in terms of the block 
cipher, and then in section 4.2 a block cipher is selected to give a fully specified algorithm set. 
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Definition of the example algorithms 



4.1 Algorithm Framework 

A 128-bit value OPc is derived from OP and K as follows: 

op c = op e e[op] k 

An intermediate 128-bit value TEMP is computed as follows: 

TEMP = E[RAND © OP c ]k 

A 128-bit value INI is constructed as follows: 

IN1[0] .. INI [47] = SQN[0] .. SQN[47] 
IN1[48] .. IN1[63] = AMF[0] .. AMF[15] 
INI [64] .. INlflll] = SQN[0] .. SQN[47] 
IN1[112] ..IN1[127]=AMF[0] ..AMF[15] 

Five 128-bit constants cl, c2, c3, c4, c5 are defined as follows: 

cl[i] = for < i < 127 

c2[i] = for < i < 127, except that c2[127] = 1 
c3[i] = for < i < 127, except that c3[126] = 1 
c4[i] = for < i < 127, except that c4[125] = 1 
c5[i] = for < i < 127, except that c5[124] = 1 
Five integers rl, r2, r3, r4, r5 are defined as follows: 
rl = 64; r2 = 0; r3 = 32; r4 = 64; r5 = 96 

Five 128-bit blocks OUT1, OUT2, OUT3, OUT4, OUT5 are computed as follows: 

OUT1 = E[TEMP 8 rot(INl © OP c , rl) © cl] K © OP c 
OUT2 = E[rot(TEMP© OP c , r2) © c2] K © OP c 
OUT3 = E[rot(TEMP© OP c , r3) © c3] K © OP c 
OUT4 = E[rot(TEMP© OP c , r4) © c4] K © OP c 
OUT5 = E[rot(TEMP© OP c , r5) © c5] K © OP c 

The outputs of the various functions are then defined as follows: 

Output of/7 = MAC-A, where MAC-A[0] .. MAC-A[63] = OUT1[0] .. OUTl[63] 
Output of/7* = MAC-S, where MAC-S[0] .. MAC-S[63] = OUTl[64] .. OUTl[127] 
Output of/2 = RES, where RES[0] .. RES[63] = OUT2[64] .. OUT2[127] 
Output of/? = CK, where CK[0] .. CK[127] = OUT3[0] .. OUT3[127] 
Output of/4 = IK, where IK[0] .. IK[127] = OUT4[0] .. OUT4[127] 
Output of/5 = AK, where AK[0] .. AK[47] = OUT2[0] .. OUT2[47] 
Output of/5* = AK, where AK[0] .. AK[47] = OUT5[0] .. OUT5[47] 

(The repeated reference to AK is not a mistake: AK is the name of the output of either /5 or/5*, and these two functions 
will not in practice be computed simultaneously.) 



4.2 Specific Example Algorithms 



The specific example algorithm set is defined by specifying the block cipher encryption function E[], which we do in 
this section. (It is left to each operator to specify the Operator Variant Algorithm Configuration Field OP.) 

The block cipher selected is Rijndael [6]. This is the algorithm proposed as the Advanced Encryption Standard [7]. 
More precisely, it is Rijndael with 128-bit key and 128-bit block size. 

E[x] k = the result of applying the Rijndael encryption algorithm 
to the 128-bit value x under the 128-bit key k. 
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Although the definitive specification of Rijndael is in [6], a complete specification of Rijndael with 128-bit key and 
128-bit block size is also given in Annex 2 of this document. 

The inputs to and output of Rijndael are defined as strings of bytes. The 128-bit string x = x[0] II x[l] II ... x[127] is 
treated as a string of bytes by taking x[0] II x[l] II ... x[7] as the first byte, x[8] II x[9] II ... x[15] as the second byte, and 
so on. The key and output string are converted in the same way. 

Note that the following patent statement has been made publicly (and included in [6]) by the authors of the Rijndael 
algorithm: "Rijndael or any of its implementations is not and will not be subject to patents." 



5 Implementation considerations 

5.1 OP c computed on or off the USIM? 

Recall that OP is an Operator Variant Algorithm Configuration Field. It is expected that each operator will define a 
value of OP which will then be used for all its subscribers. (It is up to operators to decide how to manage OP. The 
value of OP used for new batches of USIMs could be changed occasionally; or perhaps a different value could be given 
to each different USIM supplier. OP could even be given a different value for every subscriber if desired, but that is 
not really the intention.) 

It will be seen in section 4.1 that OPc is computed from OP and K, and that it is only OPc, not OP, that is ever used in 
subsequent computations. This gives two alternative options for implementation of the algorithms on the USIM: 

(a) OPc computed off the USIM: OPc is computed as part of the USIM prepersonalisation process, and OPc is 
stored on the USIM. OP itself is not stored on the USIM. 

(b) OP c computed on the USIM: OP is stored on the USIM (it may be considered as a hard-coded part of the 
algorithm if preferred). OPc is recomputed each time the algorithms are called. 

The SAGE Task Force recommends that OPc be computed off the USIM if possible, since this gives the following 
benefits: 

The complexity of the algorithms run on the USIM is reduced. 

It is more likely that OP can be kept secret. (If OP is stored on the USIM, it only takes one USIM to be reverse 
engineered for OP to be discovered and published. But it should be difficult for someone who has discovered 
even a large number of (OPc, K) pairs to deduce OP. That means that the OPc associated with any other value 
of K will be unknown, which may make it harder to mount some kinds of cryptanalytic and forgery attacks. The 
algorithms are designed to be secure whether or not OP is known to the attacker, but a secret OP is one more 
hurdle in the attacker's path.) 

5.2 Customising the choice of block cipher 

It was explained in section 3 that an operator may create a variant algorithm set by selecting a block cipher other than 
Rijndael. It is vitally important that whatever block cipher is chosen is one that has been extensively analysed and is 
still believed to be secure. The security of the authentication and key generation functions is crucially dependent on the 
strength of the block cipher. 

Strictly speaking, in fact, the kernel function does not have to be a block cipher; it just has to be a keyed function (with 
128-bit input, key and output) satisfying the following cryptographic requirement: 

Let the key be fixed. Without initial knowledge of the key, but with a large number of pairs of chosen input and 
resulting output, it must be infeasible to determine the key, and also infeasible to predict the output for any other 
chosen input with probability significantly greater than 2" 128 . 

See also section 5.4 about protecting against side channel attacks; this will need to be borne in mind when 
selecting/implementing a replacement kernel function. 
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5.3 Further customisation 

If an operator wishes to customise the algorithms still further, a simple approach is to select different values for the 
constants cl-c5 and rl-r5. If this is done, the pairs (ci, ri) must all be different . It must not be the case that both ci = 
cj and ri = rj for i t- j. For instance, it must not be the case that both c2 = c4 and r2 = r4. Additionally it is 
recommended that the following restrictions are applied: 

cl has even parity. (A 128-bit value has even parity if the number of '1 's in its binary representation is even.) 

c2-c5 all have odd parity. 

5.4 Resistance to side channel attacks 

When these algorithms are implemented on a USIM, consideration should be given to protecting them against side 
channel attacks such as differential power analysis (DPA). [8, 9, 10, 11, 12, 13] may be useful references. 
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Annex 1 : 

Figure of the Algorithms 
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Annex 2: 

Specification of the Block Cipher Algorithm Rijndael 



A2.1 Introduction 



This section provides a specification for the example kernel function. The block cipher used is Rijndael. The complete 
specification of Rijndael is given elsewhere [6], To quote from [6]: 

"Rijndael is an iterated block cipher with a variable block length and a variable key length. The block length and 
the key length can be independently specified to 128, 192 or 256 bits." 

For 3GPP purpose, Rijndael is used only in encryption mode and has the block and key length both set to 128 bits. For 
the rest of this section, when we refer to Rijndael we mean Rijndael with 128-bit block and key length. This document 
describes a simple byte oriented implementation of the encryption mode of Rijndael. Readers wishing more detail on 
the design of the cipher or implementation speed-ups are referred to the original document [6]. 



A2.2 The State and External Interfaces of Rijndael 

Rijndael is composed of a series of rounds that transform the input into the output. An intermediate result is called the 
State. The State can be pictured as a 4x4 rectangular array of bytes (128 bits in total). The Cipher Key is similarly 
pictured as a 4x4 rectangular array. These representations are illustrated in Figure 1 . 
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Figure 1 : Example of State and Cipher Key layout 

Rijndael takes plaintext bytes Po, Pi, . . .,Pis and key bytes Ko, Ki, . . .K 15 as input and ciphertext bytes Co, Ci, . . ., C15 as 
output. The plaintext bytes are mapped onto the state bytes in the order ao,o, ai,o, 82,0, 83,0, ao,i, ay, 82,1, a^i, . . . and the 
key bytes in the order k^o, k^o, k2,o, ^-3,0, ko,i, ky, k2,i, k3 ; i,. . .. At the end of the cipher operation, the ciphertext is 
extracted from the State by taking the State bytes in the same order. 

Hence if the one-dimensional index of a byte within a block is n and the two dimensional index is (i, j), we have: 

i = n mod 4; j = |_n/4j ; n = i + 4 * j 
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A2.3 Internal Structure 

Rijndael consists of the following operations: 
an initial Round Key addition 
9 rounds, numbered 1-9, each consisting of 

a byte substitution transformation 

a shift row transformation 

a mix column transformation 

a Round Key addition 
A final round (round 10) consisting of 

a byte substitution transformation 

a shift row transformation 

a Round Key addition 

The component transformations and how the Round Keys are derived from the cipher keys are specified in the 
following subsections. 

A2.4 The Byte Substitution Transformation 

The byte substitution transformation is a non-linear byte substitution, operating on each of the State bytes 
independently. The substitution table (S-box) is given in section A2.9. 

Figure 2 illustrates the effect of the byte substitution transformation on the State. 
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Figure 2: Byte substitution acts on the individual bytes of the State 

So, for every element of State, we apply the transformation: 

by = S-box[ a y ] 

Where ay is the initial value of the element in State, 
and by is the output value of the element in State. 



ETSI 



3GPP TS 35.206 version 10.0.0 Release 10 



15 



ETSI TS 135 206 V1 0.0.0 (2011-04) 



A2.5 The Shift Row Transformation 

In the shift row transformation, the rows of the State are cyclically left shifted by different amounts. Row is not 
shifted, row 1 is shifted by 1 byte, row 2 by 2 bytes and row 3 by 3 bytes. 

Figure 3 illustrates the effect of the shift row transformation on the State. 
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Figure 3: Shift Row operates on the rows of the State 



A2.6 The Mix Column Transformation 

The mix column transformation operates on each column of the State independently. For column j , we have 



bi 

b 2J 
b 3 . 



= T 2 (a 0J ) © T 3 (ay) © a 2J © a 3J 
= aoj©T 2 (a 1 j)©T 3 (a 2 j)©a3 > j 
= a 0J © a! j © T 2 (a 2J ) © T 3 (a 3J ) 
= T 3 (a 0J ) © ay © a 2J © T 2 (a 3J ) 



where: 



T 2 (a) = 2*a if a < 128 

or T 2 (a) = (2*a) © 283 if a > 128 
and T 3 (a) = T 2 (a) © a. 



For example: 



If a = 63 then T 2 (63) = 126; T 3 (63) = T 2 (63) © 63 = 65 

If a = 143 then T 2 (143) = 5; T 3 (143) = T 2 (143) © 143 = 138. 

Figure 4 illustrates the effect of the mix column transformation on the State. 
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Figure 4: Mix Column operates on the columns of the State 



A2.7 The Round Key addition 



In this operation, a Round Key is applied to the State by a simple bitwise exclusive-or. The Round Key is derived from 
the Cipher Key by means of the key schedule. The Round Key length is equal to the block length. 

This transformation is illustrated in Figure 5. 
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Figure 5: In the key addition the Round Key is bitwise XORed to the State 

So, for every element of State, we have: 

by = a i%j © rky 

Where ay is the initial value of the element in State, 

by is the output value of the element in State, and 
rky is the round key byte. 



A2.8 Key schedule 



Rijndael has 1 1 Round Keys, numbered 0-10, that are each 4x4 rectangular arrays of bytes. The Round Keys are 
derived from the Cipher Key by means of the key schedule. The initial Round Key (thought of as the zeroth Round 
Key) is formed directly from the cipher key. This zero* Round Key is used unaltered for the initial key addition. The 
remaining Round Keys are used in the ten rounds. Each new round key is derived from the previous round key. Note: It 
is possible to run the key schedule round by round on an "as required" basis and so only use a total of 16 bytes to store 
the Round Key. 

Let rk r jj be the value of the r th Round Key at position (i, j ) in the array and ky be the cipher key loaded into a 4x4 
array. 

Intialisation: rk ,y = ky for all i and j. 
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The other Round Keys (r=l to 10 inclusive) are calculated from the previous one as follows. First the th column is 
constructed: 

rk r ,o,o = r k r -i,o,o © S-box[rk r _ 1;1;3 ] © round_const[r] 
rk ra ,o = rk r _ Mi0 © S-box[rk r . 1A3 ] 
rk r ,2,o = rk r . 1A0 © S-box[rk r . 1)3)3 ] 
rk r ,3,o = rk r . 1)3 , © S-box[rk r . M , 3 ] 

where round_const[l] = 1 and round_const[r] = T 2 (round_const[r-l]), and S-box is the previously mentioned byte 
substitution. 

Then the remaining three columns are constructed in turn from the corresponding column of the previous Round Key 
and the previous column of the current Round Key: 

rk r ,ij = rk r .i ii%j © rk r , y _i for i=0,l,2,3 and j=l,2,3, 

Note: The ten round constants computed from the equations: 

round_const[1] = 1 

round_const[r] = T 2 (round_const[r-1]) r=2,3...,10 

are: 1, 2, 4, 8, 16, 32, 64, 128, 27, 54. 



A2.9 The Rijndael S-box 
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Annex 3: 

Simulation Program Listing - Byte Oriented 



Example algorithms fl, fl*, f2, f3, f4, f5, f5* 



* A sample implementation of the example 3GPP authentication and 

* key agreement functions fl, fl*, f2, f3, f4, f5 and f 5* . This is 

* a byte-oriented implementation of the functions, and of the block 

* cipher kernel function Rijndael. 

* This has been coded for clarity, not necessarily for efficiency. 
* 

* The functions f2, f3, f4 and f5 share the same inputs and have 

* been coded together as a single function. fl, fl* and f5* are 

* all coded separately. 
* 

* * / 

typedef unsigned char u8 ; 



Operator Variant Algorithm Configuration Field 



/* Insert your value of OP here */ 

u8 OP [16] = {0x63, Oxbf, 0xa5 , OxOe, 0xe6, 0x52, 0x33, 0x65, 
Oxff, 0x14, Oxcl, 0xf4, 0x5f, 0x88, 0x73, 0x7d} ; 
/* Insert your value of OP here */ 



/* prototypes 



void fl ( u8 k[16], u8 rand [16], u8 sqn[6], u8 amf [2] , 

u8 mac_a [8] ) ; 
void f2345 ( u8 k[16], u8 rand [16], 

u8 res [8], u8 ck[16], u8 ik[16], u8 ak[6] ) ; 
void flstar( u8 k[16], u8 rand [16], u8 sqn[6], u8 amf [2] , 

u8 macs [8] ) ; 
void f5star( u8 k[16], u8 rand [16], 

u8 ak[6] ) ; 
void ComputeOPc ( u8 op_c [16] ) ; 
void RijndaelKeySchedule ( u8 key[16] ) ; 
void RijndaelEncrypt ( u8 input [16] , u8 output [16] ) ; 



Algorithm fl 



* Computes network authentication code MAC-A from key K, random 

* challenge RAND, sequence number SQN and authentication management 

* field AMF. 



void fl ( u8 k[16], u8 rand [16], u8 sqn[6], u8 amf [2] 

u8 mac a [8] ) 



"I 



u8 op_c [16] ; 

u8 temp [16] ; 

u8 inl [16] ; 

u8 outl [16] ; 

u8 rijndaellnput [16] ; 

u8 i; 

RijndaelKeySchedule ( k ) ; 

ComputeOPc ( op_c ) ; 

for (i=0; i<16; i++) 

rijndaellnput [i] = rand[i] " op_c [i] 
RijndaelEncrypt ( rijndaellnput, temp ) 
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for (i=0; i<6; i++) 



inl[i] 
inl [i+8] 



sqn [i] 
sqn [i] 



for (i=0; i<2; i++) 

{ 

inl [i + 6] = amf [i] 
inl [i + 14] = amf [i] 



/* XOR op_c and inl, rotate by rl=64, and XOR * 
* on the constant cl (which is all zeroes) */ 

for (i=0; i<16; i++) 

rijndaellnput [ (i + 8) % 16] = inl [i] A op_c [i] ; 

/* XOR on the value temp computed before */ 

for (i=0; i<16; i++) 

rijndaellnput [i] A = temp[i]; 

RijndaelEncrypt ( rijndaellnput, outl ) ; 
for (i=0; i<16; i++) 
outl [i] A = op_c [i] ; 

for (i=0; i<8; i++) 
mac_a[i] = outl [i] ; 

return; 
} /* end of function fl */ 



Algorithms f2-f5 



* Takes key K and random challenge RAND, and returns response RES, 

* confidentiality key CK, integrity key IK and anonymity key AK. 



void f2345 ( u8 k [16] , u8 rand [16], 

u8 res [8], u8 ck[16], u8 ik[16], u8 ak[6] ) 

{ 

u8 op_c [16] ; 

u8 temp [16] ; 

u8 out [16] ; 

u8 rijndaellnput [16] ; 

u8 i; 

RijndaelKeySchedule ( k ) ; 

ComputeOPc ( op_c ) ; 

for (i=0; i<16; i++) 

rijndaellnput [i] = rand[i] * op_c [i] ; 
RijndaelEncrypt ( rijndaellnput, temp ) ; 

/* To obtain output block 0UT2 : XOR OPc and TEMP, * 

* rotate by r2=0, and XOR on the constant c2 (which * 

* is all zeroes except that the last bit is 1) . */ 

for (i=0; i<16; i++) 

rijndaellnput [i] = temp[i] " op_c [i] ; 
rijndaellnput [15] A = 1; 

RijndaelEncrypt ( rijndaellnput, out ) ; 
for (i=0; i<16; i++) 
out [ i ] A = op_c [ i ] ; 

for (i=0; i<8; i++) 

res [i] = out [i+8] ; 
for (i=0; i<6; i++) 

ak [ i ] = out [ i ] ; 

/* To obtain output block 0UT3 ; XOR OPc and TEMP, 
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* rotate by r3=32, and XOR on the constant c3 (which * 

* is all zeroes except that the next to last bit is 1) . */ 



for (i=0; i<16; i++) 

rijndaellnput [ (i + 12) % 16] = temp[i] " op_c [i] ; 
rijndaellnput [15] A = 2 ; 

RijndaelEncrypt ( rijndaellnput, out ) ; 
for (i=0; i<16; i++) 
out [ i ] "= op_c [ i ] ; 

for (i=0; i<16; i++) 
ck [i] = out [i] ; 

/* To obtain output block OUT4 : XOR OPc and TEMP, 

* rotate by r4=64, and XOR on the constant c4 (which 

* is all zeroes except that the 2nd from last bit is 1) 

for (i=0; i<16; i++) 

rijndaellnput [ (i + 8) % 16] = temp[i] " op_c[i]; 
rijndaellnput [15] "= 4 ; 

RijndaelEncrypt ( rijndaellnput, out ) ; 
for (i=0; i<16; i++) 
out [ i ] A = op_c [ i ] ; 

for (i=0; i<16; i++) 
ik[i] = out [i] ; 

return; 
} /* end of function f2345 */ 



Algorithm fl* 



* Computes resynch authentication code MAC-S from key K, random 

* challenge RAND, sequence number SQN and authentication management 

* field AMF. 



void flstar( u8 k[16], u8 rand [16], u8 sqn[6], u8 amf [2] 
u8 mac s [8] ) 



"I 



u8 op_c [16] ; 

u8 temp [16] ; 

u8 inl [16] ; 

u8 outl [16] ; 

u8 rijndaellnput [16] ; 

u8 i; 

RijndaelKeySchedule ( k ) ; 

ComputeOPc ( op_c ) ; 

for (i=0; i<16; i++) 

rijndaellnput [i] = rand[i] " op_c [i] 
RijndaelEncrypt ( rijndaellnput, temp ) 

for (i=0; i<6; i++) 

{ 

inl [i] = sqn [i] ; 

inl [i + 8] = sqn[i]; 

} 

for (i=0; i<2; i++) 

{ 

inl [i+6] = amf [i] ; 
inl [i + 14] = amf [i] ; 



/* XOR op_c and inl, rotate by rl=64, and XOR * 
* on the constant cl (which is all zeroes) */ 

for (i=0; i<16; i++) 

rijndaellnput [ (i + 8) % 16] = inl [i] " op_c [i] ; 
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/* XOR on the value temp computed before */ 

for (i=0; i<16; i++) 

rijndaellnput [i] A = temp[i]; 

RijndaelEncrypt ( rijndaellnput, outl ) ; 
for (i=0; i<16; i++) 
outl [i] A = op_c [i] ; 

for (i=0; i<8; i++) 
mac_s [i] = outl [i+8] ; 

return; 

/* end of function flstar */ 



Algorithm f5* 



* Takes key K and random challenge RAND, and returns resynch 

* anonymity key AK. 



-*/ 



void f5star( u8 k[16], u8 rand [16], 
u8 ak[6] ) 

{ 

u8 op_c [16] ; 

u8 temp [16] ; 

u8 out [16] ; 

u8 rijndaellnput [16] ; 

u8 i; 

RijndaelKeySchedule ( k ) ; 

ComputeOPc ( op_c ) ; 

for (i=0; i<16; i++) 

rijndaellnput [i] = rand[i] A op_c [i] ; 
RijndaelEncrypt ( rijndaellnput, temp ) ; 

/* To obtain output block 0UT5 : XOR OPc and TEMP, * 

* rotate by r5=96, and XOR on the constant c5 (which * 

* is all zeroes except that the 3rd from last bit is 1) . */ 



for (i=0; i<16; i++) 

rijndaellnput [ (i+4) % 16] 
rijndaellnput [15] A = 8 ; 



temp [i] 



op_c [i] 



RijndaelEncrypt ( rijndaellnput, out ) ; 
for (i=0; i<16; i++) 
out [ i ] A = op_c [ i ] ; 

for (i=0; i<6; i++) 
ak [i] = out [i] ; 

return; 
} /* end of function f5star */ 



* Function to compute OPc from OP and K. Assumes key schedule has 
already been performed. 



void ComputeOPc ( u8 op_c [16] ) 



RijndaelEncrypt { OP, op_c ); 
for (i=0; i<16; i++) 
op_c [i] A = OP [i] ; 

return; 

/* end of function ComputeOPc */ 



ETSI 



3GPP TS 35.206 version 10.0.0 Release 10 



22 



ETSI TS 135 206 V1 0.0.0 (2011-04) 



/*- 
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u8 roundKeys [11] [4] [4] ; 
























/*- 












Rijndael S box table -- 










--*/ 


u8 S[256] - 


{ 




























99 


124 


119 


123 


242 


107 


111 


197 


48 


1 


103 


43 


254 


215 


171 


118, 




202 


130 


201 


125 


250 


89 


71 


240 


173 


212 


162 


175 


156 


164 


114 


192, 




183 


253 


147 


38 


54 


63 


247 


204 


52 


165 


229 


241 


113 


216 


49 


21, 




4 


199 


35 


195 


24 


150 


5 


154 


7 


18 


128 


226 


235 


39 


178 


117, 




9 


131 


44 


26 


27 


110 


90 


160 


82 


59 


214 


179 


41 


227 


47 


132, 




83 


209 





237 


32 


252 


177 


91 


106 


203 


190 


57 


74 


76 


88 


207, 




208 


239 


170 


251 


67 


77 


51 


133 


69 


249 


2 


127 


80 


60 


159 


168, 




81 


163 


64 


143 


146 


157 


56 


245 


188 


182 


218 


33 


16 


255 


243 


210, 




205 


12 


19 


236 


95 


151 


68 


23 


196 


167 


126 


61 


100 


93 


25 


115, 




96 


129 


79 


220 


34 


42 


144 


136 


70 


238 


184 


20 


222 


94 


11 


219, 




224 


50 


58 


10 


73 


6 


36 


92 


194 


211 


172 


98 


145 


149 


228 


121, 




231 


200 


55 


109 


141 


213 


78 


169 


108 


86 


244 


234 


101 


122 


174 


8, 




186 


120 


37 


46 


28 


166 


180 


198 


232 


221 


116 


31 


75 


189 


139 


138, 




112 


62 


181 


102 


72 


3 


246 


14 


97 


53 


87 


185 


134 


193 


29 


158, 




225 


248 


152 


17 


105 


217 


142 


148 


155 


30 


135 


233 


206 


85 


40 


223, 




140 

}; 


161 


137 


13 


191 


230 


66 


104 


65 


153 


45 


15 


176 


84 


187 


22, 




/*- 




- This array does the multiplication by 


x in GF{2"8 




--*/ 


u8 Xtime[256] = 


{ 





























2 


4 


6 


8 


10 


12 


14 


16 


18 


20 


22 


24 


26 


28 


30, 




32 


34 


36 


38 


40 


42 


44 


46 


48 


50 


52 


54 


56 


58 


60 


62, 




64 


66 


68 


70 


72 


74 


76 


78 


80 


82 


84 


86 


88 


90 


92 


94, 




96 


98 


100 


102 


104 


106 


108 


110 


112 


114 


116 


118 


120 


122 


124 


126, 




128 


130 


132 


134 


136 


138 


140 


142 


144 


146 


148 


150 


152 


154 


156 


158, 




160 


162 


164 


166 


168 


170 


172 


174 


176 


178 


180 


182 


184 


186 


188 


190, 




192 


194 


196 


198 


200 


202 


204 


206 


208 


210 


212 


214 


216 


218 


220 


222, 




224 


226 


228 


230 


232 


234 


236 


238 


240 


242 


244 


246 


248 


250 


252 


254, 




27 


25 


31 


29 


19 


17 


23 


21 


11 


9 


15 


13 


3 


1 


7 


5, 




59 


57 


63 


61 


51 


49 


55 


53 


43 


41 


47 


45 


35 


33 


39 


37, 




91 


89 


95 


93 


83 


81 


87 


85 


75 


73 


79 


77 


67 


65 


71 


69, 




123 


121 


127 


125 


115 


113 


119 


117 


107 


105 


111 


109 


99 


97 


103 


101, 




155 


153 


159 


157 


147 


145 


151 


149 


139 


137 


143 


141 


131 


129 


135 


133, 




187 


185 


191 


189 


179 


177 


183 


181 


171 


169 


175 


173 


163 


161 


167 


165, 




219 


217 


223 


221 


211 


209 


215 


213 


203 


201 


207 


205 


195 


193 


199 


197, 




251 


249 


255 


253 


243 


241 


247 


245 


235 


233 


239 


237 


227 


225 


231 


229 





* Rijndael key schedule function. Takes 16-byte key and creates 

* all Rijndael' s internal subkeys ready for encryption. 



void RijndaelKeySchedule ( u8 key [16] ) 

{ 

u8 roundConst; 
int i , j ; 

/* first round key equals key */ 
for (i=0; i<16; i++) 

roundKeys [0] [i & 0x03] [i>>2] = key[i] 



roundConst 



1; 



/* now calculate round keys */ 
for (i=l; i<ll; i++) 



roundKeys [i] [0] [0] = 

roundKeys [i] [1] [0] = 

roundKeys [i] [2] [0] = 

roundKeys [i] [3] [0] = 

for (j=0; j<4; j+ + ) 

{ 

roundKeys [i] [j] [1] 
roundKeys [i] [j] [2] 
roundKeys [i] [j] [3] 



S [roundKeys [i-1] 

roundKeys [i-1] 
S [roundKeys [i-1] 

roundKeys [i-1] 
S [roundKeys [i-1] 

roundKeys [i-1] 
S [roundKeys [i-1] 

roundKeys [i-1] 



roundKeys [i-1] 
roundKeys [i-1] 
roundKeys [i-1] 



[1] 


[3]] 


[0] 


[0] A roundConst; 


[2] 


[3]] 


[1] 


[0] ; 


[3] 


[3]] 


[2] 


[0] ; 


[0] 


[3]] 


[3] 


[0] ; 



[j] [1] A roundKeys [i] [j] [0] 
[j] [2] A roundKeys [i] [j] [1] 
[j] [3] A roundKeys [i] [j] [2] 
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/* update round constant */ 
roundConst = Xtime [roundConst] 



return ; 

/* end of function RijndaelKeySchedule */ 



/* Round key addition function */ 

void KeyAdd(u8 state [4] [4], u8 roundKeys [11] [4] [4], int round) 

{ 

int i , j ; 

for (i=0; i<4; i++) 
for (j=0; j<4; j++) 

state [i] [j] A = roundKeys [round] [i] [j] ; 

return; 



/* Byte substitution transformation */ 
int ByteSub(u8 state [4] [4]) 

{ 

int i , j ; 

for (i=0; i<4; i++) 
for (j=0; j<4; j++) 

state [i] [j] = S [state [i] [j]] ; 

return ; 



/* Row shift transformation */ 
void ShiftRow(u8 state [4] [4]) 



u8 temp; 

/* left rotate row 1 by ] 
temp = state [1] [0] ; 
state [1] [0] = state [1] [1] 
state [1] [1] = state [1] [2] 
state [1] [2] = state [1] [3] 
state [1] [3] = temp; 

/* left rotate row 2 by 2 

temp = state [2] [0] ; 

state [2] [0] = state [2] [2] ; 

state [2] [2] = temp; 

temp = state [2] [1] ; 

state [2] [1] = state [2] [3] ; 

state [2] [3] = temp; 

/* left rotate row 3 by 3 
temp = state [3] [0] ; 
state [3] [0] = state [3] [3] 
state [3] [3] = state [3] [2] 
state [3] [2] = state [3] [1] 
state [3] [1] = temp; 



return ; 



/* MixColumn transformation*/ 
void MixColumn (u8 state [4] [4]) 



u8 temp, 
int i ; 



tmp , tmp ; 



/* do one column at a time */ 
for (i=0; i<4;i++) 



temp 
tmpO 



state [0] 
state [0] 



[i] 
[i] 



state [1] [i] 



state [2] [i] 



state [3] [i] 
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/* Xtime array does multiply by x in GF2 A 8 */ 
tmp = Xtime [state [0] [i] " state [1] [i] ] ; 
state [0] [i] A = temp " tmp; 

tmp = Xtime [state [1] [i] A state [2] [i] ] ; 
state [1] [i] A = temp * tmp; 

tmp = Xtime [state [2] [i] " state [3] [i] ] ; 
state [2] [i] A = temp " tmp; 

tmp = Xtime [state [3] [i] " tmpO] ; 
state [3] [i] A = temp " tmp; 



return; 



/* 



* Rijndael encryption function. Takes 16-byte input and creates 

* 16-byte output (using round keys already derived from 16-byte 

* key) . 



-*/ 



void RijndaelEncrypt ( u8 input [16] , u8 output [16] ) 

{ 

u8 state [4] [4] ; 
int i, r; 

/* initialise state array from input byte string */ 
for (i=0; i<16; i++) 

state [i & 0x3] [i>>2] = input [i] ; 

/* add first round_key */ 
KeyAdd (state, roundKeys, 0); 

/* do lots of full rounds */ 
for (r=l; r<=9; r++) 

{ 

ByteSub (state) ; 

ShiftRowf state) ; 

MixColumn (state) ; 

KeyAdd (state, roundKeys, r) ; 



/* final round */ 

ByteSub (state) ; 

ShiftRowf state) ; 

KeyAdd (state, roundKeys, r) ; 

/* produce output byte string from state array */ 
for (i=0; i<16; i++) 



output [i] 



state [i & 0x3] [i>>2] 



return ; 
} /* end of function RijndaelEncrypt */ 
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Annex 4: 

Rijndael Listing - 32-Bit Word Oriented 



Rijndael Implementation 



* A sample 32 -bit orientated implementation of Rijndael, the 

* suggested kernel for the example 3GPP authentication and key 

* agreement functions. 
* 

* This implementation draws on the description in section 5.2 of 

* the AES proposal and also on the implementation by 

* Dr B. R. Gladman <brg@gladman.uk.net> 9th October 2000. 

* It uses a number of large (4k) lookup tables to implement the 

* algorithm in an efficient manner. 

* Note: in this implementation the State is stored in four 32-bit 

* words, one per column of the State, with the top byte of the 

* column being the _least_ significant byte of the word. 

* * / 

#define LITTLE_ENDIAN /* For INTEL architecture */ 

typedef unsigned char u8 ; 
typedef unsigned int u32; 

/* Circular byte rotates of 32 bit values */ 



#define rotl (x) { (x << 8) | (x >> 24)) 
#define rot2 (x) { (x << 16) j (x >> 16)) 
idefine rot3 (x) ( (x << 24) j (x >> 8)) 

/* Extract a byte from a 32-bit u32 */ 

#define byteO (x) ((u8)(x)) 

#define bytel (x) <<u8)<x >> 8)) 

#define byte2 (x) ((u8) (x >> 16)) 

idefine byte3 (x) ((u8) (x >> 24)) 



/* Put or get a 32 bit u32 (v) in machine order from a byte * 
* address in (x) */ 

#ifdef LITTLE_ENDIAN 

#define u32_in(x) (*(u32*)<x)) 
#define u32_out(x,y) (*(u32*)(x) = y) 

#else 

/* Invert byte order in a 32 bit variable */ 

inline u32 byte_swap (const u32 x) 

return rotl (x) & OxOOffOOff | rot3 (x) & OxffOOffOO; 

inline u32 u32_in (const u8 x[]) 

return byte_swap (* (u32*) x) ; 

inline void u32_out (u8 x[] , const u32 v) 

*(u32*)x = byte_swap (v) ; 

#endif 

/* The lookup tables 



static u32 rnd_con[10] = 

{ 

0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, OxlB, 0x36 
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static u32 ft_tab[4] [256] 
{ 



0XA5S363C6 
0x50303060 
0X4 5CACA8F 
0XECADAD41 
0XC2B7B775 
0X5C343468 
0x0C040408 
0x0907070E 
0xlB090912 
0XF65252A4 
0XF55353A6 
0XBE6A6AD4 
0X6BD0D0BB 
0xCF45458A 
0XF35151A2 
0XDFBCBC63 
0X4CCDCD81 
0X57C4C493 
OXA06060CO 
0xCA46468C 
0X3BE0E0DB 
0X5DC2C29F 
0x32E7E7D5 
0XB46C6CD8 
0XD5BABA6F 
0X23E8E8CB 
Ox907070EO 
0XA36161C2 
0X38E1E1D9 
0XB69B9B2D 
0x8F8C8C03 
0xC3414182 



0x847C7CF8 
0x03010102 
0x9D82821F 
0X67D4D4B3 
OxlCFDFDEl 
0XF4A5A551 
0X52C7C795 
0x36121224 
0X9E83831D 
0X4D3B3B76 
0X68D1D1B9 
0X46CBCB8D 
0X2AEFEFC5 
0X10F9F9E9 
0XFEA3A35D 
0XC1B6B677 
0X140C0C18 
0XF2A7A755 
0x98818119 
0X29EEEEC7 
0x56323264 
0x6ED3D3BD 
0X43C8C88B 
0XFA5656AC 
0x887878F0 
0X7CDDDDA1 
0X423E3E7C 
0X5F35356A 
0xl3F8F8EB 
0X221E1E3C 
0XF8A1A159 
0XB0999929 



0X997777EE 
0XA96767CE 
0X40C9C989 
0XFDA2A2 5F 
0XAE93933D 
0X34E5E5D1 
0x65232346 
0x9B80801B 
0X742C2C58 
0x61D6D6B7 
0000000000 
0XD9BEBE67 
0XE5AAAA4F 
0x06020204 
0xC0404080 
0X75DADAAF 
0x35131326 
0X827E7EFC 
0XD14F4F9E 
0XD3B8B86B 
0X4E3A3A74 
0XEFACAC43 
0X5937376E 
0X07F4F4F3 
0X6F25254A 
0X9C7474E8 
0xC4B5B571 
0XF95757AE 
0XB398982B 
0x92878715 
0x80898909 
0X772D2D5A 



0X8D7B7BF6 
0X7D2B2B56 
0X877D7DFA 
0XEAAFAF4 5 
0X6A26264C 
0X08F1F1F9 
0X5EC3C3 9D 
0x3DE2E2DF 
0X2E1A1A34 
0XCEB3B37D 
0X2CEDEDC1 
0X4B393972 
0X16FBFBED 
0X817F7FFE 
0X8A8F8F05 
0x63212142 
0x2FECECC3 
0X473D3D7A 
0X7FDCDCA3 
0X3C141428 
0xlE0A0A14 
0XA66262C4 
0XB76D6DDA 
0X2 5EAEACF 
0X722E2E5C 
0X211F1F3E 
0XAA6666CC 
0XD0B9B969 
0x33111122 
0x20E9E9C9 
0X170DOD1A 
OxllOFOFlE 



0X0DF2F2FF 
0X19FEFEE7 
0X15FAFAEF 
0XBF9C9C23 
0X5A36366C 
0X937171E2 
0x28181830 
0X26EBEBCD 
0X2D1B1B36 
0X7B292952 
0x60202040 
0XDE4A4A94 
0xC5434386 
0XF05050A0 
0XAD92923F 
0x30101020 
0XE15F5FBE 
0XAC6464C8 
0x66222244 
0X79DEDEA7 
0XDB494992 
0XA8919139 
0X8C8D8D01 
0XAF6565CA 
0X241C1C38 
0XDD4B4B96 
0XD8484890 
0x91868617 
0XBB6969D2 
0X49CECE87 
0XDABFBF6 5 
0XCBB0B07B 



0XBD6B6BD6 
0X62D7D7B5 
0XEB5959B2 
0XF7A4A4 53 
0X413F3F7E 
0X73D8D8AB 
0XA1969637 
0x6927274E 
0XB26E6EDC 
0x3EE3E3DD 
0xlFFCFCE3 
0XD44C4C98 
0XD74D4D9A 
0X443C3C78 
0XBC9D9D21 
0X1AFFFFE5 
0XA2979735 
0XE75D5DBA 
0X7E2A2A54 
0XE25E5EBC 
OxOA06060C 
0XA4959531 
0X64D5D5B1 
0X8E7A7AF4 
0XF1A6A657 
0XDCBDBD61 
0x05030306 
0X58C1C199 
0X70D9D9A9 
0XFF5555AA 
0x31E6E6D7 
0XFC5454A8 



0XB16F6FDE 
0XE6ABAB4D 
0XC947478E 
0X967272E4 
0X02F7F7F5 
0x53313162 
0x0F05050A 
0XCDB2B27F 
0XEE5A5AB4 
0X712F2F5E 
0XC8B1B179 
0XE85858B0 
0x55333366 
0XBA9F9F25 
0x48383870 
0X0EF3F3FD 
0xCC444488 
0x2B191932 
0XAB90903B 
0xlD0B0B16 
0X6C242448 
0X37E4E4D3 
0XD24E4E9C 
0XE9AEAE4 7 
0XC7B4B473 
0X868B8B0D 
0x01F6F6F7 
0X271D1D3A 
0x898E8E07 
0x78282850 
OxC6424284 
0XD6BBBB6D 



0X54C5C591 
0X9A7676EC 
OxOBFOFOFB 
0X5BC0C09B 
0X4FCCCC83 
0x3F15152A 
0XB59A9A2F 
0x9F7575EA 
0XFBA0A05B 
0x97848413 
0XED5B5BB6 
0X4ACFCF85 
0x94858511 
0XE3A8A84B 
0X04F5F5F1 
0x6DD2D2BF 
Ox3917172E 
Ox957373E6 
0x8388880B 
0X76DBDBAD 
0XE45C5CB8 
0x8B7979F2 
0XE0A9A94 9 
0x18080810 
0X51C6C697 
0x858A8A0F 
0X120E0E1C 
0XB99E9E27 
0XA7949433 
0X7ADFDFA5 
0XB86868D0 
0x3A16162C 



0x6363C6A5 
0x30306050 
0XCACA8F4 5 
0XADAD41EC 
0XB7B775C2 
0X3434685C 
0x0404080C 
Ox07070E09 
0x0909121B 
0X5252A4F6 
0X5353A6F5 
0X6A6AD4BE 
0XD0D0BB6B 
0X45458ACF 
0X5151A2F3 
0XBCBC63DF 
0xCDCD814C 
0XC4C49357 
0X606OCOAO 
0X46468CCA 
0XE0E0DB3B 
OxC2C29F5D 
0XE7E7D532 
0x6C6CD8B4 
0XBABA6FD5 
0XE8E8CB23 
0X7070E090 
Ox6161C2A3 
0XE1E1D938 
0x9B9B2DB6 
Ox8C8C038F 
0X414182C3 



0X7C7CF884 
0x01010203 
0x82821F9D 
0XD4D4B367 
OxFDFDEllC 
0XA5A5 51F4 
0XC7C79552 
0x12122436 
0x83831D9E 
0x3B3B764D 
0XD1D1B968 
0xCBCB8D46 
0XEFEFC52A 
0XF9F9E910 
0XA3A35DFE 
0XB6B677C1 
0x0C0C1814 
0XA7A755F2 
0x81811998 
0XEEEEC729 
0x32326456 
0XD3D3BD6E 
0xC8C88B43 
0X5656ACFA 
0X7878F088 
0XDDDDA17C 
0X3E3E7C42 
0x35356A5F 
0XF8F8EB13 
0X1E1E3C22 
0XA1A159F8 
Ox999929BO 



0X7777EE99 
0X6767CEA9 
0xC9C98940 
0XA2A2 5FFD 
0x93933DAE 
0XE5E5D134 
0x23234665 
0x80801B9B 
0X2C2C5874 
0XD6D6B761 
0000000000 
0XBEBE67D9 
0XAAAA4FE5 
0x02020406 
0X404080C0 
0XDADAAF75 
0x13132635 
0X7E7EFC82 
0X4F4F9ED1 
0XB8B86BD3 
0X3A3A744E 
0XACAC43EF 
0X37376E59 
0XF4F4F307 
0X25254A6F 
0X7474E89C 
0XB5B571C4 
0X5757AEF9 
0X98982BB3 
0x87871592 
0x89890980 
0X2D2D5A77 



0X7B7BF68D 
0X2B2B567D 
0X7D7DFA87 
0XAFAF4 5EA 
0X26264C6A 
0XF1F1F908 
OxC3C39D5E 
0XE2E2DF3D 
0X1A1A342E 
0XB3B37DCE 
0XEDEDC12C 
0x3939724B 
0XFBFBED16 
0X7F7FFE81 
0X8F8F058A 
0x21214263 
0XECECC32F 
0X3D3D7A4 7 
0XDCDCA37F 
0X1414283C 
OxOAOA141E 
0x6262C4A6 
0X6D6DDAB7 
0XEAEACF2 5 
0X2E2E5C72 
0X1F1F3E21 
0x6 6 6 6CCAA 
0XB9B969D0 
0x11112233 
0XE9E9C920 
0X0D0D1A17 
OxOFOFlEll 



0XF2F2FF0D 
0XFEFEE719 
0XFAFAEF15 
0X9C9C23BF 
0x36366C5A 
0X7171E293 
0x18183028 
0XEBEBCD2 6 
0X1B1B362D 
0x2929527B 
0x20204060 
0X4A4A94DE 
0X434386C5 
0X5050A0F0 
0x92923FAD 
0x10102030 
0X5F5FBEE1 
Ox6464C8AC 
0x22224466 
0XDEDEA779 
0X494992DB 
0X919139A8 
0x8D8D018C 
0x6565CAAF 
0X1C1C3824 
0X4B4B96DD 
0X484890D8 
0x86861791 
0x6969D2BB 
0xCECE8749 
0XBFBF65DA 
0XB0B07BCB 



0X6B6BD6BD 
0XD7D7B562 
0X5959B2EB 
0XA4A453F7 
0X3F3F7E41 
0XD8D8AB73 
0X969637A1 
Ox27274E69 
0x6E6EDCB2 
0XE3E3DD3E 
0XFCFCE31F 
0X4C4C98D4 
0X4D4D9AD7 
0X3C3C7844 
0x9D9D21BC 
0XFFFFE51A 
0X979735A2 
0X5D5DBAE7 
0X2A2A54 7E 
0X5E5EBCE2 
0x06060C0A 
0x959531A4 
0XD5D5B164 
0X7A7AF48E 
0XA6A657F1 
0XBDBD61DC 
0x03030605 
0XC1C19958 
0XD9D9A970 
0X5555AAFF 
0XE6E6D731 
0X5454A8FC 



0X6F6FDEB1 
0XABAB4DE6 
0X47478EC9 
0X7272E496 
OXF7F7F502 
0x31316253 
0x05050A0F 
0XB2B27FCD 
0X5A5AB4EE 
0X2F2F5E71 
0XB1B179C8 
OX5858B0E8 
0x33336655 
0x9F9F25BA 
0x38387048 
0XF3F3FD0E 
0X444488CC 
0X1919322B 
0x90903BAB 
0x0B0B161D 
Ox2424486C 
0XE4E4D337 
0X4E4E9CD2 
0XAEAE4 7E9 
0XB4B473C7 
0X8B8B0D86 
0XF6F6F701 
0X1D1D3A27 
0x8E8E0789 
0x28285078 
0X424284C6 
0XBBBB6DD6 



0XC5C59154 
0X7676EC9A 
OxFOFOFBOB 
0xC0C09B5B 
OxCCCC834F 
0X15152A3F 
0x9A9A2FB5 
0X7575EA9F 
0XA0A0 5BFB 
0x84841397 
0X5B5BB6ED 
0xCFCF854A 
0x85851194 
0XA8A84BE3 
0XF5F5F104 
0XD2D2BF6D 
0X17172E39 
0X7373E695 
0x88880B83 
0XDBDBAD76 
0X5C5CB8E4 
0X7979F28B 
0XA9A949E0 
0x08081018 
0xC6C69751 
0x8A8A0F85 
0X0E0E1C12 
0x9E9E27B9 
Ox949433A7 
0XDFDFA57A 
0X6868D0B8 
0xl6162C3A 



{ 

0x63C6A563, 0x7CF8847C, Ox77EE9977, 
0x306 05 03 0, 0x0102 03 01 , 0x67CEA967 , 
0xCA8F45CA, Ox821F9D82, OxC98940C9, 
0XAD41ECAD, 0xD4B3 6 7D4, 0xA2 5FFDA2, 
0XB775C2B7, OxFDEllCFD, 0x933DAE93, 



0X7BF68D7B, OxF2FFODF2, 0x6BD6BD6B, 0x6FDEB16F, 0xC59154C5, 
0X2B567D2B, 0XFEE719FE, 0xD7B562D7, 0xAB4DE6AB, 0X76EC9A76, 
0X7DFA877D, OxFAEF15FA, 0X59B2EB59, 0X478EC947, OxFOFBOBFO, 
0XAF45EAAF, Ox9C23BF9C, 0xA453F7A4, 0x72E49672, 0xC09B5BC0, 
0X264C6A26, 0X366C5A36, 0X3F7E413F, 0XF7F502F7, 0xCC834FCC, 
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0X34685C34 
0x04080C04 
0x070E0907 
Ox09121B09 
0X52A4F652 
0X53A6F553 
0X6AD4BE6A 
0XD0BB6BD0 
0X458ACF45 
0X51A2F351 
0XBC63DFBC 
0xCD814CCD 
0XC49357C4 
OX60COA060 
0X4 68CCA4 6 
0XE0DB3BE0 
0xC2 9F5DC2 
0XE7D532E7 
0x6CD8B46C 
0XBA6FD5BA 
0XE8CB23E8 
OX70E09070 
0x61C2A361 
0XE1D938E1 
0x9B2DB69B 
0x8C038F8C 
0X4182C341 



0XA551F4A5 
0XC79552C7 
0x12243612 
0x831D9E83 
0x3B764D3B 
0XD1B968D1 
0xCB8D46CB 
0XEFC52AEF 
0XF9E910F9 
0XA35DFEA3 
0XB677C1B6 
0x0C18140C 
0XA755F2A7 
0x81199881 
0XEEC729EE 
0x32645632 
0XD3BD6ED3 
0xC88B43C8 
0X56ACFA56 
0X78F08878 
0XDDA17CDD 
0X3E7C423E 
0X356A5F35 
0XF8EB13F8 
0X1E3C221E 
0XA159F8A1 
0X9929B099 



0XE5D134E5 
0x23466523 
0x801B9B80 
0X2C58742C 
0XD6B761D6 
0000000000 
0XBE67D9BE 
0XAA4FE5AA 
0x02040602 
0X4080C040 
0XDAAF75DA 
0x13263513 
0X7EFC827E 
0X4F9ED14F 
0XB86BD3B8 
0X3A744E3A 
0XAC43EFAC 
0X376E5937 
OXF4F307F4 
0X254A6F25 
0X74E89C74 
0XB571C4B5 
0X57AEF957 
0X982BB398 
0x87159287 
0x89098089 
0X2D5A772D 



0XF1F908F1 
0XC39D5EC3 
0XE2DF3DE2 
0X1A342E1A 
0XB37DCEB3 
0XEDC12CED 
0X39724B39 
0XFBED16FB 
0X7FFE817F 
0X8F058A8F 
0x21426321 
0XECC32FEC 
0X3D7A473D 
0XDCA37FDC 
0X14283C14 
0x0A141E0A 
0x62C4A662 
0X6DDAB76D 
0XEACF2 5EA 
0X2E5C722E 
0X1F3E211F 
0X66CCAA6 6 
0XB969D0B9 
0x11223311 
0XE9C920E9 
0X0D1A170D 
OxOFlEllOF 



0X71E29371 
0x18302818 
0XEBCD2 6EB 
0X1B362D1B 
0x29527B29 
0x20406020 
0X4A94DE4A 
0X4386C543 
0X50A0F050 
0x923FAD92 
0x10203010 
0X5FBEE15F 
0X64C8AC64 
0x22446622 
0XDEA779DE 
0X4992DB49 
0X9139A891 
0x8D018C8D 
0x65CAAF6 5 
0X1C38241C 
0X4B96DD4B 
0X4890D848 
0x86179186 
0x69D2BB69 
0XCE8749CE 
0XBF6 5DABF 
0XB07BCBB0 



0XD8AB73D8 
0X9637A196 
Ox274E6927 
0x6EDCB26E 
0XE3DD3EE3 
0XFCE31FFC 
0X4C98D44C 
0X4D9AD74D 
0X3C78443C 
0x9D21BC9D 
0XFFE51AFF 
0X9735A297 
0X5DBAE75D 
0X2A547E2A 
0X5EBCE25E 
OX060COA06 
0x9531A495 
0XD5B164D5 
0X7AF4 8E7A 
0XA657F1A6 
0XBD61DCBD 
0x03060503 
0XC19958C1 
0XD9A970D9 
0X55AAFF55 
0XE6D731E6 
0X54A8FC54 



0x31625331 
0x050A0F05 
0XB2 7FCDB2 
0X5AB4EE5A 
0X2F5E712F 
0XB179C8B1 
0X58B0E858 
0x33665533 
Ox9F25BA9F 
0x38704838 
0XF3FD0EF3 
0X4488CC44 
0X19322B19 
0x903BAB90 
0x0B161D0B 
Ox24486C24 
0XE4D337E4 
0X4E9CD24E 
0XAE4 7E9AE 
0XB473C7B4 
0X8B0D868B 
0XF6F701F6 
0xlD3A271D 
0x8E07898E 
0x28507828 
0X4284C642 
0XBB6DD6BB 



0X152A3F15, 
0X9A2FB59A, 
0X75EA9F75, 
0XA0 5BFBA0, 
0x84139784, 
0X5BB6ED5B, 
0xCF854ACF, 
0x85119485, 
0XA84BE3A8, 
0XF5F104F5, 
0XD2BF6DD2, 
0X172E3917, 
0X73E69573, 
0x880B8388, 
0XDBAD76DB, 
0X5CB8E45C, 
0X79F28B79, 
0XA949E0A9, 
0x08101808, 
0XC69751C6, 
0x8A0F858A, 
0X0E1C120E, 
0x9E27B99E, 
Ox9433A794, 
0XDFA57ADF, 
0X68D0B868, 
0xl62C3A16 



0XC6A56363 
0x60503030 
0x8F45CACA 
0X41ECADAD 
0X75C2B7B7 
0X685C3434 
Ox080C0404 
0x0E090707 
OX121B0909 
0XA4F65252 
0XA6F55353 
0XD4BE6A6A 
0XBB6BD0D0 
0X8ACF4 54 5 
0XA2F35151 
0x63DFBCBC 
Ox814CCDCD 
0X9357C4C4 
OxCOA06 06 
0x8CCA4 64 6 
0XDB3BE0E0 
0x9F5DC2C2 
0XD532E7E7 
0XD8B46C6C 
0X6FD5BABA 
0xCB23E8E8 
0XE0907070 
0xC2A3 6161 
0XD938E1E1 
0x2DB69B9B 
0x038F8C8C 
Ox82C34141 



0XF8847C7C 
0x02030101 
0X1F9D8282 
0XB367D4D4 
OxEllCFDFD 
0X51F4A5A5 
0X9552C7C7 
0x24361212 
0xlD9E8383 
0X764D3B3B 
0XB968D1D1 
0x8D46CBCB 
0XC52AEFEF 
0XE910F9F9 
0X5DFEA3A3 
0X77C1B6B6 
0X18140C0C 
0X55F2A7A7 
0x19988181 
0XC729EEEE 
0x64563232 
0XBD6ED3D3 
0x8B43C8C8 
0XACFA5656 
0XF0887878 
0XA17CDDDD 
0X7C423E3E 
0x6A5F3535 
0XEB13F8F8 
0X3C221E1E 
0X59F8A1A1 
0X29B09999 



0XEE997777 
0xCEA96767 
0x8940C9C9 
0X5FFDA2A2 
0x3DAE9393 
0XD134E5E5 
0x46652323 
0xlB9B8080 
0X58742C2C 
0XB761D6D6 
0000000000 
0X67D9BEBE 
0X4FE5AAAA 
0x04060202 
0x80004040 
0XAF75DADA 
0x26351313 
0XFC827E7E 
Ox9ED14F4F 
0x6BD3B8B8 
0X744E3A3A 
0X43EFACAC 
0X6E593737 
0XF307F4F4 
0X4A6F2525 
0XE89C7474 
0X71C4B5B5 
0XAEF95757 
0X2BB39898 
0x15928787 
0x09808989 
0X5A772D2D 



0XF68D7B7B 
0X567D2B2B 
0XFA877D7D 
0X4 5EAAFAF 
0X4C6A2 62 6 
0XF908F1F1 
0x9D5EC3C3 
0XDF3DE2E2 
0X342E1A1A 
0X7DCEB3B3 
OxC12CEDED 
0X724B3939 
0XED16FBFB 
0XFE817F7F 
0X058A8F8F 
0x42632121 
0XC32FECEC 
0X7A473D3D 
0XA37FDCDC 
0X283C1414 
Oxl41EOAOA 
0xC4A662 62 
0XDAB76D6D 
0XCF2 5EAEA 
0X5C722E2E 
0X3E211F1F 
0xCCAA6666 
0x69D0B9B9 
0x22331111 
0XC920E9E9 
OX1A170DOD 
OxlEllOFOF 



0XFF0DF2F2 
0XE719FEFE 
0XEF15FAFA 
0X23BF9C9C 
0x6C5A3636 
0XE2937171 
0x30281818 
0XCD2 6EBEB 
0X362D1B1B 
0X527B2929 
0x40602020 
0X94DE4A4A 
0x86C54343 
0XA0F05050 
0x3FAD9292 
0x20301010 
0XBEE15F5F 
0xC8AC6464 
0x44662222 
0XA779DEDE 
0X92DB4949 
0X39A89191 
0x018C8D8D 
0xCAAF6565 
0X38241C1C 
0X96DD4B4B 
0x90D84848 
0x17918686 
0XD2BB6969 
0x8749CECE 
0X65DABFBF 
0X7BCBB0B0 



0XD6BD6B6B 
0XB562D7D7 
0XB2EB5959 
0X53F7A4A4 
0X7E413F3F 
0XAB73D8D8 
0X37A19696 
0X4E692727 
0XDCB26E6E 
0XDD3EE3E3 
0XE31FFCFC 
0x98D44C4C 
0X9AD74D4D 
0X78443C3C 
0x21BC9D9D 
0XE51AFFFF 
0X35A29797 
0XBAE75D5D 
0X547E2A2A 
0XBCE25E5E 
OXOCOA0606 
0x31A49595 
0XB164D5D5 
0XF4 8E7A7A 
0X57F1A6A6 
0X61DCBDBD 
0x06050303 
0X9958C1C1 
0XA970D9D9 
0XAAFF5555 
0XD731E6E6 
0XA8FC5454 



0XDEB16F6F 
0X4DE6ABAB 
0X8EC94747 
0XE4967272 
0XF502F7F7 
0x62533131 
0x0A0F0505 
0X7FCDB2B2 
0XB4EE5A5A 
0X5E712F2F 
0X79C8B1B1 
0XB0E85858 
0x66553333 
0x25BA9F9F 
0x70483838 
0XFD0EF3F3 
0x88CC4444 
0x322B1919 
0x3BAB9090 
0X161D0B0B 
0X486C2424 
0XD337E4E4 
0X9CD24E4E 
0X4 7E9AEAE 
0X73C7B4B4 
0X0D868B8B 
0XF701F6F6 
0X3A271D1D 
0x07898E8E 
0x50782828 
0x84C64242 
0X6DD6BBBB 



0X9154C5C5, 
0XEC9A7676, 
OxFBOBFOFO, 
0X9B5BC0C0, 
0x834FCCCC, 
0x2A3F1515, 
0x2FB59A9A, 
0XEA9F7575, 
0X5BFBA0A0, 
0x13978484, 
0XB6ED5B5B, 
0X854ACFCF, 
0x11948585, 
0X4BE3A8A8, 
0XF104F5F5, 
0XBF6DD2D2, 
0x2E391717, 
0XE6957373, 
0x0B838888, 
0XAD76DBDB, 
0XB8E45C5C, 
0XF28B7979, 
0X4 9E0A9A9, 
0x10180808, 
0X9751C6C6, 
0x0F858A8A, 
0X1C120E0E, 
0x27B99E9E, 
0x33A79494, 
0XA57ADFDF, 
0XD0B86868, 
0x2C3A1616 



static u32 fl_tab[4] [256] 
{ 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



00063, 
00030, 
OOOCA, 
OAD , 
000B7, 
00034, 
00004, 
00007, 
00009, 
00052, 
00053, 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



0007C, 
00001, 
00082, 
000D4, 
OOOFD, 
000A5, 
000C7, 
00012, 
00083, 
0003B, 
000D1, 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



00077, 
00067, 
000C9, 
000A2, 
00093, 
000E5, 
00023, 
00080, 
0002C, 
000D6, 
00000, 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



0007B, 
0002B, 
0007D, 
00 OAF, 
00026, 
000F1, 
000C3, 
000E2, 
0001A, 
000B3, 
OOOED, 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



000F2, 
OOOFE, 
OOOFA, 
0009C, 
00036, 
00071, 
00018, 
OOOEB, 
0001B, 
00029, 
00020, 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



0006B, 
000D7, 
00059, 
000A4, 
0003F, 
000D8, 
00096, 
00027, 
0006E, 
000E3, 
OOOFC, 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



0006F, 
OAB , 
00047, 
00072, 
000F7, 
00031, 
00005, 
000B2, 
0005A, 
0002F, 
000B1, 



0x0 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



000C5, 
00076, 
OOOFO, 
OOOCO, 
OOOCC, 
00015, 
0009A, 
00075, 
OOOAO, 
00084, 
0005B, 
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0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



0006A, 
000D0, 
00045, 
00051, 
000BC, 
000CD, 
000C4, 
00060, 
00046, 
OOOEO, 
000C2, 
000E7, 
0006C, 
000BA, 
000E8, 
00070, 
00061, 
OOOE1, 
0009B, 
0008C, 
00041, 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



000CB, 
OOOEF, 
000F9, 
0A3, 
000B6, 

ooooc, 

000A7, 

00081, 
OOOEE, 
00032, 
000D3, 
000C8, 
00056, 
00078, 
OOODD, 
0003E, 
00035, 
000F8, 
0001E, 
000A1, 
00099, 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



OOOBE, 
OOOAA, 
00002, 
00040, 
OOODA, 
00013, 
0007E, 
0004F, 
000B8, 
0003A, 
OOOAC, 
00037, 
000F4, 
00025, 
00074, 
000B5, 
00057, 
00098, 
00087, 
00089, 
0002D, 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



00039, 
OOOFB, 
0007F, 
0008F, 
00021, 
OOOEC, 
0003D, 
OOODC, 
00014, 
OOOOA, 
00062, 
0006D, 
OOOEA, 
0002E, 
0001F, 
00066, 
000B9, 
00011, 
000E9, 
OOOOD, 
OOOOF, 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



0004A, 
00043, 
00050, 
00092, 
00010, 
0005F, 
00064, 
00022, 
OOODE, 
00049, 
00091, 
0008D, 
00065, 
0001C, 
0004B, 
00048, 
00086, 
00069, 
OOOCE, 
OOOBF, 
OOOBO, 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



0004C, 
0004D, 
0003C, 
0009D, 
OOOFF, 
00097, 
0005D, 
0002A, 
0005E, 
00006, 
00095, 
000D5, 
0007A, 
000A6, 
OOOBD, 
00003, 
000C1, 
000D9, 
00055, 
000E6, 
00054, 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



00058, 
00033, 
0009F, 
00038, 
000F3, 
00044, 
00019, 
00090, 
OOOOB, 
00024, 
000E4, 
0004E, 
OAE , 
000B4, 
0008B, 
000F6, 
0001D, 
0008E, 
00028, 
00042, 
OOOBB, 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



OOOCF, 
00085, 
000A8, 
000F5, 
000D2, 
00017, 
00073, 
00088, 
OOODB, 
0005C, 
00079, 
000A9, 
00008, 
000C6, 
0008A, 
OOOOE, 
0009E, 
00094, 
OOODF, 
00068, 
00016 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



06300 
03000 
OCAOO 
OADOO 
0B700 
03400 
00400 
00700 
00900 
05200 
05300 
06A00 
ODOOO 
04500 
05100 
OBCOO 
OCDOO 
0C400 
06000 
04600 
OEOOO 
0C200 
0E700 
06C00 
OBAOO 
0E800 
07000 
06100 
0E100 
09B00 
08C00 
04100 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



07C00 
00100 
08200 
0D400 
OFDOO 
0A500 
0C700 
01200 
08300 
03B00 
0D100 
OCBOO 
OEFOO 
0F900 
0A3 
0B600 

oocoo 

0A700 

08100 
OEEOO 
03200 
0D300 
0C800 
05600 
07800 
ODDOO 
03E00 
03500 
0F800 
01E00 
0A100 
09900 



0x0 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
00000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



07700 
06700 
0C900 
0A2 00 
09300 
0E500 
02300 
08000 
02C00 
0D600 
00000 
OBEOO 
OAAOO 
00200 
04000 
ODAOO 
01300 
07E00 
04F00 
0B800 
03A00 
OACOO 
03700 
0F400 
02500 
07400 
OB500 
05700 
09800 
08700 
08900 
02D00 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



07B00 
02B00 
07D00 
OAF 
02600 
0F100 
0C300 
0E200 
01A0 
0B300 
OEDOO 
03900 
OFBOO 
07F00 
08F00 
02100 
OECOO 
03D00 
ODCOO 
01400 
OOAOO 
06200 
06D00 
OEAOO 
02E00 
01F00 
06600 
0B900 
01100 
0E900 
OODOO 
OOFOO 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



0F200 
OFEOO 
OFAOO 
09C00 
03600 
07100 
01800 
OEBOO 
01B00 
02900 
02000 
04A00 
04300 
05000 
09200 
01000 
05F00 
06400 
02200 
ODEOO 
04900 
09100 
08D00 
06500 
01C00 
04B00 
04800 
08600 
06900 
OCEOO 
OBFOO 
OBOOO 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



06B00 
0D700 
05900 
0A4 00 
03F00 
0D800 
09600 
02700 
06E00 
0E300 
OFCOO 
04C00 
04D00 
03C00 
09D00 
OFFOO 
09700 
05D00 
02A00 
05E00 
00600 
09500 
0D500 
07A00 
0A600 
OBDOO 
00300 
0C100 
0D900 
05500 
0E600 
05400 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



06F00 
OABOO 
04700 
07200 
0F700 
03100 
00500 
0B200 
05A00 
02F00 
0B100 
05800 
03300 
09F00 
03800 
0F300 
04400 
01900 
09000 
OOBOO 
02400 
0E400 
04E00 
OAE 
0B400 
08B00 
0F600 
01D00 
08E00 
02800 
04200 
OBBOO 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



0C500 
07600 
OFOOO 

ocooo 
occoo 

01500 
09A00 
07500 
OAOOO 
08400 
05B00 
OCFOO 
08500 
0A800 
0F500 
0D200 
01700 
07300 
08800 
ODBOO 
05C00 
07900 
0A900 
00800 
0C600 
08A00 
OOEOO 
09E00 
09400 
ODFOO 
06800 
01600 



{ 

0x00630000, 

0x00300000, 
OxOOCAOOOO, 
OxOOADOOOO, 
OxOOB70000, 
0x00340000, 
0x00040000, 
0x00070000, 
0x00090000, 
0x00520000, 
0x00530000, 
0x006A0000, 
OxOODOOOOO, 
0x00450000, 
0x00510000, 
OxOOBCOOOO, 
OxOOCDOOOO, 
0X00C40000, 
0x00600000, 
0x00460000, 
OxOOEOOOOO, 



Ox007COOOO, 
0x00010000, 
0x00820000, 
0x00D40000, 
OxOOFDOOOO, 
0X00A50000, 
0X00C70000, 
0x00120000, 
0x00830000, 
0x003B0000, 
OxOODlOOOO, 
OxOOCBOOOO, 
OxOOEFOOOO, 
0x00F90000, 
OxOOA30000, 
0x00B60000, 
OxOOOCOOOO, 
0x00A70000, 
0x00810000, 
OxOOEEOOOO, 
0x00320000, 



0x00770000 
0x00670000 
OxOOC90000 
OxOOA20000 
0x00930000 
0x00E50000 
0x00230000 
0x00800000 
0x002C0000 
0x00D60000 
0000000000 
OxOOBEOOOO 
OxOOAAOOOO 
0x00020000 
0x00400000 
OxOODAOOOO 
0x00130000 
Ox007EOOOO 
0x004F0000 
0x00B80000 
0x003A0000 



Ox007BOOOO, 
0x002B0000, 
Ox007DOOOO, 
OxOOAFOOOO, 
0x00260000, 
OxOOFlOOOO, 
0X00C30000, 
0x00E20000, 
OxOOlAOOOO, 
OxOOB30000, 
OxOOEDOOOO, 
0x00390000, 
OxOOFBOOOO, 
Ox007FOOOO, 
0x008F0000, 
0x00210000, 
OxOOECOOOO, 
0x003DOOOO, 
OxOODCOOOO, 
0x00140000, 
OxOOOAOOOO, 



OxOOF20000 
OxOOFEOOOO 
OxOOFAOOOO 
0X009C0000 
0x00360000 
0x00710000 
0x00180000 
OxOOEBOOOO 
OxOOlBOOOO 
0x00290000 
0x00200000 
0x004A0000 
0x00430000 
0x00500000 
0x00920000 
0x00100000 
0x005F0000 
0x00640000 
0x00220000 
OxOODEOOOO 
0x00490000 



0x006B0000, 
0x00D70000, 
0x00590000, 
OxOOA40000, 
0x003FOOOO, 
0x00D80000, 
0x00960000, 
0x00270000, 
Ox006EOOOO, 
OxOOE30000, 
OxOOFCOOOO, 
Ox004COOOO, 
0x004D0000, 
0x003C0000, 
0x009D0000, 
OxOOFFOOOO, 
0x00970000, 
0x005D0000, 
0x002A0000, 
0x005E0000, 
0x00060000, 



0x006F0000, 
OxOOABOOOO, 
0x00470000, 
0x00720000, 
OXOOF70000, 
0x00310000, 
0x00050000, 
OxOOB20000, 
0x005A0000, 
0x002F0000, 
OxOOBlOOOO, 
0x00580000, 
0x00330000, 
0x009F0000, 
0x00380000, 
0X00F30000, 
0x00440000, 
0x00190000, 
0x00900000, 
OxOOOBOOOO, 
0x00240000, 



OxOOC50000, 
0x00760000, 
OxOOFOOOOO, 
OxOOCOOOOO, 
OxOOCCOOOO, 
0x00150000, 
0X009A0000, 
0x00750000, 
OxOOAOOOOO, 
0x00840000, 
0x005B0000, 
OxOOCFOOOO, 
0x00850000, 
0X00A80000, 
OxOOF50000, 
0x00D20000, 
0x00170000, 
0x00730000, 
0x00880000, 
OxOODBOOOO, 
Ox005COOOO, 
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0X00C20000, 
OxOOE70000, 
0X006C0000, 
OxOOBAOOOO, 
OxOOE80000, 
0x00700000, 
0x00610000, 
OxOOElOOOO, 
Ox009BOOOO, 
OxOO8C0000, 
0x00410000, 



0x00D30000, 
0X00C80000, 
0x00560000, 
0x00780000, 
OxOODDOOOO, 
0X003EOOOO, 
0x00350000, 
0X00F80000, 
OxOOlEOOOO, 
OxOOAlOOOO, 
0x00990000, 



OxOOACOOOO, 
0x00370000, 
OxOOF40000, 
0x00250000, 
0x00740000, 
0xOOB50000, 
0x00570000, 
0x00980000, 
0x00870000, 
0x00890000, 
0x002D0000, 



0x00620000, 
0x006D0000, 
OxOOEAOOOO, 
0x002E0000, 
OxOOlFOOOO, 
0x00660000, 
0x00B90000, 
0x00110000, 
0X00E90000, 
OxOOODOOOO, 
OxOOOFOOOO, 



0x00910000, 
0x008D0000, 
0x00650000, 
OxOOlCOOOO, 
0x004B0000, 
0x00480000, 
0x00860000, 
0x00690000, 
OxOOCEOOOO, 
OxOOBFOOOO, 
OxOOBOOOOO, 



0x00950000, 
0x00D50000, 
Ox007AOOOO, 
0x00A60000, 
OxOOBDOOOO, 
0x00030000, 
OxOOClOOOO, 
0x00D90000, 
0x00550000, 
0X00E60000, 
0x00540000, 



OxOOE40000, 
0x004E0000, 
OxOOAEOOOO, 
OxOOB40000, 
0x008B0000, 
OxOOF60000, 
OxOOlDOOOO, 
0X008E0000, 
0x00280000, 
0x00420000, 
OxOOBBOOOO, 



0x00790000, 
0x00A90000, 
0x00080000, 
0X00C60000, 
0x008A0000, 
OxOOOEOOOO, 
0x009E0000, 
0x00940000, 
OxOODFOOOO, 
0x00680000, 
0x00160000 



0x630 
0x3 
OxCAO 
OxADO 
0xB70 
0x340 
0x040 
0x070 
0x090 
0x520 
0x530 
0x6A0 
OxDOO 
0x4 5 
0x510 
OxBCO 
OxCDO 
OxC4 
0x6 
0x4 60 
OxEOO 
0xC2 
0xE70 
0x6C0 
OxBAO 
0xE80 
0x700 
0x610 
OxElO 
0x9B0 
0x8C0 
0x410 



00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 



Ox7CO 
0x010 
0x820 
0xD4 
OxFDO 
0xA50 
OxC70 
0x120 
0x830 
0x3B0 
OxDIO 
OxCBO 
OxEFO 
0xF90 
0xA30 
0xB60 
OxOCO 
0xA70 
0x810 
OxEEO 
0x320 
0xD30 
0xC80 
0x560 
0x780 
OxDDO 
0x3E0 
0x350 
0xF80 
OxlEO 
OxAlO 
0x990 



00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 



0x770 
0x670 
0xC90 
0xA2 
0x930 
0xE50 
0x2 3 
0x800 
0x2C0 
0xD60 
00000 
OxBEO 
OxAAO 
0x020 
0x4 00 
OxDAO 
0x130 
0x7E0 
0x4F0 
0xB80 
0x3A0 
OxACO 
0x370 
0xF4 
0x2 50 
0x740 
OxB50 
0x570 
0x980 
0x870 
0x890 
Ox2DO 



00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 



Ox7BO 
0x2B0 
0x7D0 
OxAFO 
0x2 60 
OxFlO 
0xC3 
0xE2 
OxlAO 
0xB30 
OxEDO 
0x390 
OxFBO 
0x7F0 
0x8F0 
0x210 
OxECO 
0x3D0 
OxDCO 
0x140 
OxOAO 
0x620 
0x6D0 
OxEAO 
0x2E0 
OxlFO 
0x660 
0xB90 
0x110 
0xE90 
OxODO 
OxOFO 



00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 



OxF2 
OxFEO 
OxFAO 
0x9C0 
0x360 
0x710 
0x180 
OxEBO 
OxlBO 
0x2 9 
0x2 
0x4A0 
0x430 
0x500 
0x920 
0x100 
0x5F0 
0x640 
0x220 
OxDEO 
0x4 90 
0x910 
0x8D0 
0x650 
OxlCO 
Ox4BO 
0x4 80 
0x860 
0x690 
OxCEO 
OxBFO 
OxBOO 



00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 



0x6B0 
0xD70 
0x590 
OxA4 
0x3F0 
0xD80 
0x960 
0x270 
0x6E0 
0xE30 
OxFCO 
Ox4CO 
0x4D0 
0x3C0 
0x9D0 
OxFFO 
0x970 
0x5D0 
0x2A0 
0x5E0 
0x060 
0x950 
0xD50 
0x7A0 
0xA60 
OxBDO 
0x030 
OxCIO 
0xD90 
0x550 
0xE60 
0x540 



00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 



0x6F0 
OxABO 
0x4 7 
0x720 
OxF70 
0x310 
0x050 
0xB2 
0x5A0 
0x2F0 
OxBlO 
0x580 
0x330 
0x9F0 
0x380 
0xF30 
0x44 
0x190 
0x900 
OxOBO 
0x24 
OxE4 
Ox4EO 
OxAEO 
OxB4 
0x8B0 
0xF60 
OxlDO 
0x8E0 
0x2 80 
0x42 
OxBBO 



00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 



OxC5 
0x760 
OxFOO 
OxCOO 
OxCCO 
0x150 
0x9A0 
0x750 
OxAOO 
0x840 
0X5B0 
OxCFO 
0x850 
0xA80 
0xF50 
0xD2 
0x170 
0x730 
0x880 
OxDBO 
Ox5CO 
0x790 
0xA90 
0x080 
0xC6 
0x8A0 
OxOEO 
0x9E0 
0x940 
OxDFO 
0x680 
0x160 



00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 
00000 



The workspace 



static u32 Ekey[44] 



/* The expanded key */ 



/* The round Function. 4 table lookups and 4 Exors 



-*/ 



#define f rnd(x, n) 

{ ft tab[0] [byteO (x [n] ) ] 
" ft_tab[l] [bytel(x[(n + 

* ft tab [2] [byte2(x[(n + 

* ft_tab[3] [byte3(x[(n + 


1) & 

2) & 

3) & 


3])] 
3])] 
3])] 


) 


\ 
\ 
\ 
\ 


#define f round (bo, bi, k) 
bo[0] = f rnd(bi, 0) A 
bo[l] = f_rnd(bi, 1) " 
bo [2] = f rnd(bi, 2) " 
bo [3] = f rnd(bi, 3) " 


k[0] 
k[l] 
k[2] 
k[3] 




\ 
\ 
\ 
\ 

\ 





/*- 



The S Box lookup used in constructing the Key schedule 



#define ls_box(x) 

( fl_tab[0] [byteO (x) 

" fl_tab[l] [bytel(x) 

* fl_tab[2] [byte2 (x) 

" fl_tab[3] [byte3 (x) 



\ 

] \ 
] \ 
] \ 
] ) 



/* The last round function (no MixColumn) 

#define lf_rnd(x, n) \ 

{ fl_tab[0] [byteO(x[n] )] \ 

" fl_tab[l] [bytel(x[(n + 1) & 3])] \ 

* fl_tab[2] [byte2 (x [ (n + 2) & 3])] \ 
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fl_tab[3] [byte3 (x[ (n + 3) & 3] ) ] ) 



* RijndaelKeySchedule 

* Initialise the key schedule from a supplied key 



*/ 
void RijndaelKeySchedule (u8 key[16]) 
{ 



U32 t; 






u32 *ek=Ekey, /* 


pointe 


*rc=rnd con; /* 


pointe 


Ekey[0] = u32 in (key 


); 


Ekey[l] = u32 in (key + 


4) 




Ekey[2] = u32 in (key + 


8) 




Ekey[3] = u32 in (key + 


12) 




while (ek < Ekey + 40) 

{ 

t = rot3 (ek[3] ) ; 






ek[4] = ek[0] A Is 


box ( t ) 


ek[5] = ek[l] A ek"[4] ; 


ek[6] = ek[2] A ek[5] ; 


ek[7] = ek[3] A ek[S] ; 


ek += 4; 







o the expanded key */ 
/* pointer to the round constant */ 



/* 

* RijndaelEncrypt 

* Encrypt an input block 
*/ 

void RijndaelEncrypt (u8 in [16], u8 out [16] ) 



u32 



bO [4] , bl[4], *kp = Ekey; 



b0[0] = u32_in(in ) " *kp4 

bO [1] = u32_in(in + 4) " *kp4 

b0[2] = u32_in(in + 8) " *kp4 

bO [3] = u32_in(in + 12) " *kp4 



f round (bl, 


bO, 


kp) 








f round ( b , 


bl, 


kp) 








f round (bl, 


bO, 


kp) 








f round ( b , 


bl, 


kp) 








f round (bl, 


bO, 


kp) 








f round ( b , 


bl, 


kp) 








f round (bl, 


bO, 


kp) 








f round ( b , 


bl, 


kp) 








f round (bl, 


bO, 


kp) 








u32 out (out 




11 


: rnd(bl, 


0) 


* kp[0] ) 


u32_out (out 


+ 


4, 11 


: rnd(bl, 


1) 


A kp[l]) 


u32_out (out 


+ 


8, 11 


: rnd(bl, 


2) 


A kp[2] ) 


u32_out (out 


4 12, 11 


: rnd(bl, 


3) 


* kp[3]) 
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Annex A (informative); 
Change history 



Change history 


TSGSA 

# 


Version 


CR 


Tdoc SA 


New 
Version 


Subject/Comment 


SP-10 


SAGE 
v 1.1 


- 


SP-010673 


3.0.0 


Approved as Release 1999 


SP-11 


3.0.0 


- 


- 


4.0.0 


Updated to Release 4 


SP-16 


4.0.0 


- 


- 


5.0.0 


Updated to Release 5 


SP-20 


5.0.0 


001 


SP-030226 


5.1.0 


Addition of missing line to Rijndael S-box listing 


SP-26 


5.0.0 


- 


- 


6.0.0 


Updated to Release 6 


SP-36 


6.0.0 


- 


- 


7.0.0 


Updated to Release 7 


SP-42 


7.0.0 


- 


- 


8.0.0 


Updated to Release 8 


SP-46 


8.0.0 


- 


- 


9.0.0 


Updated to Release 9 


SP-51 


9.0.0 


- 


- 


10.0.0 


Updated to Release 10 
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